Bug 143894 – Use ASan poisoning to taint moved-out-of Refs

• Component: Web Template Framework
• Status: RESOLVED FIXED

[Alexey Proskuryakov]

It has been suggested that we can taint Refs to check that they are not used after moving out.

I'm not sure if we can practically expect to catch any bugs (the pointer is already zeroed out), but this seems easy enough to do, and harmless. Could catch something one day.

<rdar://problem/19443723>

[Alexey Proskuryakov]

Created attachment 251042 [details]
proposed patch

[Sam Weinig]

Comment on attachment 251042 [details]
proposed patch

View in context: https://bugs.webkit.org/attachment.cgi?id=251042&action=review

> Source/WTF/wtf/Ref.h:38
> +#if ASAN_ENABLED
> +extern "C" void __asan_poison_memory_region(void const volatile *addr, size_t size);
> +extern "C" void __asan_unpoison_memory_region(void const volatile *addr, size_t size);
> +extern "C" bool __asan_address_is_poisoned(void const volatile *addr);
> +#endif

I think this should probably be in Compiler.h, since it seems like this could be generally useful.  Perhaps we should also put it behind some nicer macros / inline functions.

[WebKit Commit Bot]

Comment on attachment 251042 [details]
proposed patch

Clearing flags on attachment: 251042

Committed r182977: <http://trac.webkit.org/changeset/182977>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.